PRV - Reporting a Health Insurance Portability Accountability Act (HIPAA) Incident to the Contract Administration Office (CAO)

Transcription

1 PRV - Reporting a Health Insurance Portability Accountability Act (HIPAA) Incident to the Contract Administration Office (CAO) Purpose: The purpose of this procedure is to identify, resolve and report a HIPAA violation to the State. As a contractor, Provider Services staff have in their possession necessary Protected Health Information (PHI) that is disclosed by the State to perform its obligations under the contract. Identification of Roles: Primary Role- Provider Services Associate Analyst Performance Standards: N/A Path of Business Procedure: Step 1: Receive concern or complaint a. The Customer Service Representative (CSR) receives a call or written correspondence from the provider stating that the provider received correspondence or documentations that did not belong to them. Step 2: Complete HIPAA Compliance Incident Report a. The staff member completes the HIPAA Compliance Incident Report and attaches available OnBase documentation that relates to the incident and forwards the report via to the Associate Analyst at lhuber@dhs.state.ia.us Step 3: the form to the Associate Analyst a. The Associate Analyst reviews the complaint and ensures that all documentation is attached and completes the form to report a breach of unsecured protected health information before forwarding it to the Contract Administration Office (CAO). Step 4: Report the incident and resolution a. The Associate Analyst s the incident report and documentation to the CAO, Stephanie Clark (Sclark2@dhs.state.ia.us) with a copy to the Department of Human Services (DHS) Unit Manager and Provider Services Account Manger Step 5: Save the a. The Associate Analyst saves the sent to the CAO in the folder titled HIPAA Incidents found in the Associate Analyst s personal share drive. Forms/Reports: Provider Services HIPAA Compliance Incident Report Information Security Date Breach Incident Report DHS Information Security and Privacy Office Page 1 of 7

2 RFP References: N/A Interfaces: CAO Attachments: Provider Services HIPAA Compliance Incident Report Information Security Date Breach Incident Report DHS Information Security and Privacy Office Process Map Page 2 of 7

3 PROVIDER SERVICES HIPAA COMPLIANCE INCIDENT REPORT: Please complete this form to report a security incident. All incidents are to be reported immediately. this form to Linda Huber. lhuber@dhs.state.ia.us REPORTED BY: DATE: PROVIDER NAME: PROVIDER NUMBER: PROVIDER PHONE NUMBER: DESCRIPTION OF INCIDENT: DATE OF INCIDENT: TIME OF INCIDENT: WHAT WAS DONE TO CORRECT THE INCIDENT? Page 3 of 7

4 Page 4 of 7

5 Page 5 of 7

6 Page 6 of 7

7 REPORTING HIPAA INCIDENTS STAFF ASSOCIATE ANAYLYST Receive concern or compliant. 1 Complete HIPAA Compliance Incident Report. 2 the form to the Associate Analyst. 3 Report the incident and resolution. 4 Save the . 5 Page 7 of 7